CVE-2026-57135 in PraisonAI
Summary
by MITRE • 09/15/2026
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does not establish an operating-system network boundary. Programs that ignore those proxy variables can open sockets directly, allowing supposedly isolated commands to reach localhost, internal services, cloud metadata, or external hosts and potentially exfiltrate data. An initial remediation was released in version 1.7.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within PraisonAI versions ranging from 1.2.3 through 1.7.2 represents a critical failure in the implementation of network isolation for sandboxed execution environments. PraisonAI utilizes a multi-agent team architecture where tasks are often executed in isolated sandboxes to prevent lateral movement and data exfiltration between agents or from untrusted code to the host system. The specific flaw resides in the SandboxExecutor component, particularly within the file src/praisonai-ts/src/cli/features/sandbox-executor.ts. When operating in network-isolated mode, the system relies on a function named buildEnv() to configure the execution environment for these sandboxed processes. However, this implementation is fundamentally flawed because it attempts to enforce isolation solely by injecting invalid or restrictive http_proxy and https_proxy environment variables into the process context. This approach assumes that all network-bound applications will respect proxy settings as their sole method of egress control, which is a dangerous assumption in software engineering.
The core technical flaw lies in the misconception that setting HTTP proxy environment variables constitutes a sufficient security boundary for network isolation. Many programming languages and libraries provide direct socket access APIs that bypass standard library abstractions such as urllib or requests, thereby ignoring proxy configuration entirely. By relying exclusively on these environment variable injections without establishing an operating-system level network boundary, PraisonAI fails to prevent processes from opening raw TCP sockets directly to any destination. This architectural weakness allows malicious or compromised agents to circumvent the intended isolation by connecting directly to localhost interfaces, internal corporate services, cloud provider metadata endpoints such as AWS EC2 instance metadata service, or arbitrary external hosts on the internet. Consequently, commands that are supposed to be strictly isolated can successfully communicate with sensitive resources, leading to potential data exfiltration and unauthorized access to backend infrastructure.
From a threat modeling perspective, this vulnerability aligns closely with CWE-693, which describes Protection Mechanism Failure where an application fails to protect against attacks by exploiting weaknesses in its security mechanisms. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1048, specifically subtechnique T1048.002 for Exfiltration Over Alternative Protocol if alternative protocols are used, or more broadly to lateral movement and data staging techniques that rely on direct network connections rather than standard web traffic patterns. The impact of this flaw is severe in multi-agent scenarios where one agent might be compromised by a prompt injection attack or malicious code execution. Once an attacker gains control over such an agent within the sandbox, they can leverage this bypass to reach internal databases, read sensitive configuration files via local services, or steal cloud credentials exposed through metadata APIs, effectively breaking out of the containment boundary intended by the security architecture.
Although an initial remediation was released in version 1.7.2, it is imperative for organizations deploying PraisonAI to verify that their current implementation fully addresses this class of vulnerability. Relying on application-level proxy settings is insufficient for true network isolation; effective mitigation requires implementing OS-level controls such as Linux namespaces with network namespace separation, container runtime policies like Docker or Kubernetes network policies, or firewall rules that explicitly deny all outbound traffic except what is strictly necessary and whitelisted. Security architects should audit the sandbox-executor logic to ensure it utilizes robust isolation mechanisms rather than heuristic environment variable manipulation. Until comprehensive OS-level boundaries are enforced, any code executed within these sandboxes must be treated as potentially capable of full network access, necessitating additional layers of defense such as strict egress filtering at the host or container level and rigorous input validation for all agent-generated commands to minimize the attack surface available for exploitation.